Layer 7 Rules Groups in pfSense 2.1

Layer 7

Adding a layer 7 rules group in pfSense 2.1.

In the previous article, I described how to create a traffic shaping rule to place BitTorrent traffic into the P2P queue. Another way of directing traffic into queues is to create a layer 7 rules group. In this article, I will describe how to do this.

Traditionally, network traffic is identified by looking at IP packet fields or by referring to which port is being used. In the OSI network model, this method is limited to looking at layers 3 and 4. This is highly constricting, but fortunately there is a better way. We can inspect packets at the application layer (also known as deep packet inspection), which provides us with a powerful solution for controlling traffic based on application patterns. Since this functionality is built into pfSense 2.0 and later, we can easily create rules for layer 7 inspection.


Creating an Layer 7 Rules Group

As an illustration, I will again turn to the example of limiting bandwidth used by BitTorrent traffic by placing it in the P2P queue. First, navigate to Firewall -> Traffic Shaper, and click on the Layer 7 tab. Once there, click on the “plus” button to add a new Layer 7 rule. At “Enable/Disable“, check the checkbox to enable this layer 7 container. At “Name“, you can enter a name, and at “Description“, you can enter a description that will not be parsed. At “Rule(s)“, press the “plus” button to add one or more rules. There are three dropdown boxes: “Protocol“, “Structure“, and “Behaviour“. For “Protocol“, you can select any one of dozens of protocols; I won’t list all of them here, but some of the more significant ones are:

  • DHCP: Dynamic Host Configuration Protocol, an application level netwprk protocol used to configure devices that are connected to a network so they can communicate on that network using the Internet Protocol (IP).
  • Finger: The Finger user information protocol, which provides basic user information on some systems.
  • HTTP: Hypertext Transfer Protocol, the main application protocol for the World Wide Web.
  • UUCP: Unix-to-Unix Copy, a suite of computer programs and protocols allowing remote execution of commands and transfer of files, email, and netnews between computers.

In our case, we’ll choose “bittorrent” as the protocol. Under “Structure“, we can choose either “action” or “queue”. “action” seems to have one option under “Behaviour“: “block”. Since we don’t want to block bittorrent traffic, but instead want to put it in the P2P queue, we select “queue”. For “Behavior“, we select “qP2P” (the P2P queue). We could add another rule, but instead we will press the “Save” button to save the rules group, and “Apply changes” on the next page.

This covers how to add an layer 7 rules group. But there is an alternative way of adding a layer 7 rules group: when you first click on the “Layer 7” tab, there should be a hyperlink to add new layer 7 protocol patterns. Click on this link, then on the “Add layer7 pattern” page, press the “Choose” button and select a file with the file dialog box. When you are done, press the “Upload Pattern file” button to upload the file.

This article should be enough to get you started with using layer 7 rules groups, but if you want a more in-depth explanation of Layer 7 traffic control and how it was implemented in pfSense, you may want to read this scholarly paper on L7 in the pfSense platform (also linked to in the external links section).


Other Articles in This Series:

Traffic Shaping in pfSense: What it Does
Traffic Shaping Wizard: Introduction
Queue Configuration in pfSense 2.1
Traffic Shaping Rules in pfSense 2.1
Traffic Shaping Rules in pfSense 2.1
Bandwidth Limiting with the pfSense Limiter
Deep Packet Inspection Using Layer 7 Traffic Shaping

External Links:

L7 Classification and Policing in the pfSense Platform – a more comprehensive explanation of layer 7 rules and their integration into pfSense.

Traffic Shaping Guide at doc.pfsense.org

Ad Links:


© 2013 David Zientara. All rights reserved. Privacy Policy